Alerting

Is there a way to ingest data via an email response?

nick405060
Motivator

Hi there,

We send out alerts via Splunk about potential phishing attacks. We'd like to have users mark the alerts after they have received and investigated them - e.g. label them as investigated, false positive, true positive, etc. Is there a way for users to label the alert directly in the email? (e.g., using voting buttons to send a response back to Splunk where the metrics are aggregated, or by having the users respond to the email)

I could create a dashboard showing all the alerts, with textboxes to enter the labels/data, but I'd like to hear ideas on a more elegant (preferably email or Slack-based) solution

1 Solution

jkat54
SplunkTrust
SplunkTrust

You could build this yourself and put links in the emails that link back to api endpoints.

You’d need some unique identifier generated for each alert so you could reference the Id when your users “vote”.

Imagine a link in email like this:

<a href=“https://localhost:8089/.../yourApp/handler/_update?uniqueId=$idField$&status=closed”>Close this</a>

See https://docs.splunk.com/Documentation/Splunk/7.2.3/AdvancedDev/CustomAlertScript for details on the alert action portion

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

@nick405060 Is your problem resolved? If so, please accept an answer.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

bean545
New Member

Thanks for the information.

0 Karma

jkat54
SplunkTrust
SplunkTrust

You could build this yourself and put links in the emails that link back to api endpoints.

You’d need some unique identifier generated for each alert so you could reference the Id when your users “vote”.

Imagine a link in email like this:

<a href=“https://localhost:8089/.../yourApp/handler/_update?uniqueId=$idField$&status=closed”>Close this</a>

See https://docs.splunk.com/Documentation/Splunk/7.2.3/AdvancedDev/CustomAlertScript for details on the alert action portion

View solution in original post

nick405060
Motivator

Thanks!! This definitely seems like the best option so far. A little above my skill level, but I can take a crack at it

jkat54
SplunkTrust
SplunkTrust

There’s more than a handful of partners that do this sort of development. If it’s a high stakes use case, you might consider hiring outside help.

By the way, all this was once above everyone else’s skill level too. You got what it takes to learn splunk development ;-). Just have patience!

jkat54
SplunkTrust
SplunkTrust

Did you build this out?

0 Karma

nick405060
Motivator

Had to put it off a bit due to the amount of time it's going to take. On my radar for the next 4-5 weeks

0 Karma

jkat54
SplunkTrust
SplunkTrust

Cool, come see us in #app-dev on slack when you’re ready!

0 Karma

valiquet
Contributor

We have that but it's not recommended. SMTP is unreliable protocol.

0 Karma

sdchakraborty
Contributor

Hello,

Please take a look at the below app. Not sure fully whether this will resolve your query. Very interesting use case.

https://splunkbase.splunk.com/app/1739/

Sid

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!